problem is that it bring new rules in Web world, every plugins can bring security holes this should not be a chrome concern, like if window start to block steam because they think it is not enought secure, or any other software... this is not fair

yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.

Given the very poor state the applet plugin was in for more than a decade and the still very marginal use and the massive security problem, I personally think it's a fair attempt at raising the bar to get infected.

Hi, appreciate more people! Σ ♥ = ¾Learn how to award medals... and work your way up the social rankings!

In a perfect world maybe, but I cant imagine there is not something behind

this is not a good solution, security hole are everywhere and the global security gain here is negligeable, it just increase the bad reputation of java

once again just imagine tha Microsoft decide Chrome is not enought secure... should they block it this way ? I mean they could just decide to sell a security certification to any software running on window, but is it real solution ? thundirbird, Outlook, IE, Chrome, FF, Steam, Skype, Emul etc... are all potential nice infection vector

nowaday not only browser are using internet, security must be thinked more globally, the gain in security is so poor that this cannot be something else than a "pike" to Oracle

yup, looks like some anti competition play here from Google. The flash plugin continues to work as before with no block even though it was massively targeted too. Don't forget that Oracle released a massive patch ball with the last Java 1.6.0_24 release which fixed most of the known security holes, so not sure that argument holds much weight.

Flash is integrated into Chrome. Like Chrome itself, it's kept up to date automatically.

Java's update rate is pretty sluggish.

By the way, Firefox blocks old versions of Java completely. E.g. 1.6.0_07 (can't figure out the exact version number, but I know that they blocked that one) and everything before gets blocked. Everything prior to _10 doesn't work anyways (incompatible).

I posted about how outrageous this is and all I got was that I have my facts wrong and then they disabled commenting on the issue alltogether And I thought I liked Google

I read your replies there.

Keep in mind that you are not dealing with 'Google' here but with people. You're certainly acting immature and have just pissed off somebody at the position to make significant changes, ruining it for others that would have more informed arguments as apposed to "But clearly this exchange was a waste of both our times." Like that ever helped in a discussion.

Hi, appreciate more people! Σ ♥ = ¾Learn how to award medals... and work your way up the social rankings!

To ra4kings defence; It wasn't his comment that stated "But clearly this exchange was a waste of both our times."

That aside, I see where google is coming from. The one thing that Chrome has really taken heat for, is it's lack of security. So it's understandable that they're trying to address security issues. Do I personally like it? No. Would my mother like it, if she knew what it was in the first place? Definitely.

@AddictmanBut Java is not Google's to control. Google can't take heat for security issues on behalf of Java so I really see no point to block autorun for all version of Java. They should only block older versions because it is getting quite annoying allowing every single site I go to.

I understand what you mean, and as I said, I personally don't like it. But Java's installed on so many computers around the world, and so few of those computers actually *use* java actively. Let's face it, the members of this forum aren't exactly the average user when it comes to Java. So, if/when a new huge gaping security hole emerges in the current java version, what's the safest thing to do? Ignore it, and wait for Oracle to fix it, and risk the vast majority of users around the world that have java installed but don't know what it is, to go into a tantrum over Google because they erroneously think Chrome's the culprit? Or, force those that actually use java services to "click once".

At the risk of having an unpopular opinion in this forum, I really don't mind this. They're essentially embedding functionality similar to (parts of) NoScript into the browser. Of course, I do see the concern as a Java developer about user perception.

Folks often say that users will usually click "Yes" to any dialog asking them anything, without even reading or understanding it, to try to get software working on their computers. Might that happen in this scenario as well - "Oh, I have to click OK here to use my banking site, whatever"?

It seems a bit overprotective, but on the other hand companies like Apple have been practising stuff like this for years...

I must also admit that after surfing sites that are filled with applets, I have at some point actually wanted a feature like this. I have a plugin like that for delaying Flash loading called FlashBlock. However as with FlashBlock I as the user made the decision, not the author of the browser...

In regards to security, I'm not sure how much difference it will do. People will still click the "Allow virus to install" button. Only the 10% that doesn't will be a tiny bit more protected (future Java patches should fix it anyways).

Hmm, I wonder how big the chances of a removal of this feature is, if Java security goes up...

I do and always have had java blocked by default. Same with java script and flash. I want to surf and read the web, not have the web intrude on me. I enable these "run client side" features only for specific pages or cases.

Quite frankly not only do i understand where google is coming from. I think its a good idea.

I have no special talents. I am only passionately curious.--Albert Einstein

a problem is also that if the user is asked once (by Chrome), logicaly user have been prevent and than the Applet should then be given full access without the need to be signed (stupid to ask twice), this completly make the sandbox of java Applet useless/obsolete.

If Applet is considered as unsafe it should not need to be signed anymore, continu to ask for a secure certificat to gain full access will mean unsigned Applet are considered secure

java-gaming.org is not responsible for the content posted by its members, including references to external websites,
and other references that may or may not have a relation with our primarily
gaming and game production oriented community.
inquiries and complaints can be sent via email to the info‑account of the
company managing the website of java‑gaming.org